Backend/moderation: Restore author-visibility filtering for thread comments and replies

[aapeliv]

The recent UMS moderation PRs for thread comments/replies (#8510) and discussions (#8511) introduced where_moderated_content_visible(), which only checks an item's moderation state — not whether its author is a deleted, banned, blocked, or shadowed user.

In threads.py the moderation PR replaced where_users_column_visible() with where_moderated_content_visible() instead of applying both. The two are orthogonal checks and are used together everywhere else in the codebase (references.py, api.py, requests.py, etc.). The regression: comments and replies authored by invisible users were no longer hidden from other users.

This PR:

• Restores where_users_column_visible() alongside where_moderated_content_visible() in all GetThread queries (comment list, reply list, parent-comment existence check) and in total_num_responses().
• Fixes a pre-existing inconsistency where the per-comment num_replies count included replies regardless of moderation state or author visibility — it now uses a correlated subquery with both filters, matching the depth-1 reply list.

Discussions are cluster-owned community content and were never filtered by creator visibility (before or after the moderation PR), so they are intentionally left unchanged.

Testing

• Added test_comment_by_invisible_user_hidden and test_reply_by_invisible_user_hidden to test_threads.py. Both approve the moderation state so they isolate the author-visibility check; the reply test also asserts the parent comment's num_replies count drops when the replier is deleted.
• uv run pytest src/tests/test_threads.py src/tests/test_discussions.py src/tests/test_events.py — all pass.
• make format and make mypy clean for the changed files.

Backend checklist

• Added tests for any new code or added a regression test if fixing a bug
• Run the backend locally and it works
• Added migrations if there are any database changes, rebased onto develop if necessary for linear migration history

For maintainers

• Maintainers can push commits to my branch
• Maintainers can merge this PR for me

This PR was created with the Couchers PR skill.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
couchers	Ready	Preview	May 17, 2026 3:35am

[github-actions]

📝 Release Notes

This PR should be included in the release notes.

Suggested release note:

Fixed a thread moderation bug that could show comments and replies from users who should have been hidden

🤖 Bot Debug Information

Model: couchers.openai.gpt-5.4
Decision: include
Reasoning: This fixes a moderation/privacy regression where comments and replies from deleted, banned, blocked, or otherwise invisible users could still appear in threads and be counted. That is a noticeable user-facing bug affecting content visibility and safety expectations, so it should be included.